Skip to content

chore(deps): Bump the cargo group across 2 directories with 8 updates - #32

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/sdk/linux/cargo-dcddfa4c30
Closed

chore(deps): Bump the cargo group across 2 directories with 8 updates#32
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/sdk/linux/cargo-dcddfa4c30

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the cargo group with 7 updates in the /sdk/linux directory:

Package From To
base64 0.22.1 0.23.0
sha2 0.10.9 0.11.0
digest 0.10.7 0.11.3
rand 0.8.7 0.10.2
thiserror 1.0.69 2.0.19
jsonwebtoken 10.4.0 11.0.0
p256 0.13.2 0.14.0

Bumps the cargo group with 5 updates in the /sdk/rust directory:

Package From To
base64 0.22.1 0.23.0
sha2 0.10.9 0.11.0
thiserror 1.0.69 2.0.19
jsonwebtoken 10.4.0 11.0.0
hmac 0.12.1 0.13.0

Updates base64 from 0.22.1 to 0.23.0

Changelog

Sourced from base64's changelog.

0.23.0

  • Added more consts for preconfigured configs and engines
  • Make DecodeError::InvalidLastSymbol more clear by including the decoded value
  • Added SIMD-accelerated engines behind the default-on simd-unsafe feature: Simd picks the best instruction set at runtime (AVX2 on x86_64, NEON on aarch64) and falls back to the scalar GeneralPurpose engine, while Avx2 and Neon target one instruction set with no runtime detection and work in no_std. The engines support the standard and URL-safe alphabets.
  • Update MSRV to 1.71.0
  • Add support for custom padding symbols
Commits
  • 9e9220a v0.23.0
  • 870326e Merge pull request #306 from marshallpierce/mp/trailing-bits-docs
  • fbec5f1 Document no trailing trailing bits
  • 0a23549 Merge pull request #305 from marshallpierce/mp/edition-2021
  • f10b7e2 Update deps & edition
  • 9d21a59 Merge pull request #304 from marshallpierce/mp/custom-padding-rebase
  • f70bad2 Support custom padding symbols
  • 684d79c Merge pull request #301 from marshallpierce/mp/simd-gardening
  • 5bf66f2 Merge pull request #284 from AbeZbm/add-tests
  • d3831cf Followups to SIMD work
  • Additional commits viewable in compare view

Updates sha2 from 0.10.9 to 0.11.0

Commits

Updates digest from 0.10.7 to 0.11.3

Commits
  • 2fb9ed8 Release digest v0.11.3 (#2402)
  • 086cf38 digest: add TryCustomizedInit trait (#2395)
  • 9488e7e signature v3.0.0 (#2400)
  • 2917d19 build(deps): bump the all-deps group across 1 directory with 4 updates (#2398)
  • 7b029ba signature: add AsyncVerifier, AsyncMultipartVerifier, `AsyncDigestVerifie...
  • c6d4dd7 elliptic-curve v0.14.0-rc.32 (#2399)
  • f2069a2 elliptic-curve: bump pkcs8 to v0.11 (#2397)
  • 8250383 elliptic-curve: bump pkcs8 to v0.11.0-rc.12 (#2396)
  • 54e464f signature: remove long-winded intro section in rustdoc (#2392)
  • 5cb62a4 signature: enable/fix workspace-level lints; reformat docs (#2391)
  • Additional commits viewable in compare view

Updates rand from 0.8.7 to 0.10.2

Changelog

Sourced from rand's changelog.

[0.10.2] — 2026-07-02

Fixes

  • Fix possible memory safety violation due to deserialization of UniformChar from bad source (#1790)

Changes

  • Document required output order of fn partial_shuffle and apply #[must_use] (#1769)
  • Avoid usage of unsafe in contexts where non-local memory corruption could invalidate contract (#1791)

#1769: rust-random/rand#1769 #1790: rust-random/rand#1790 #1791: rust-random/rand#1791

[0.10.1] — 2026-02-11

This release includes a fix for a soundness bug; see #1763.

Changes

  • Document panic behavior of make_rng and add #[track_caller] (#1761)
  • Deprecate feature log (#1763)

#1761: rust-random/rand#1761 #1763: rust-random/rand#1763

[0.10.0] - 2026-02-08

Changes

  • The dependency on rand_chacha has been replaced with a dependency on chacha20. This changes the implementation behind StdRng, but the output remains the same. There may be some API breakage when using the ChaCha-types directly as these are now the ones in chacha20 instead of rand_chacha (#1642).
  • Rename fns IndexedRandom::choose_multiple -> sample, choose_multiple_array -> sample_array, choose_multiple_weighted -> sample_weighted, struct SliceChooseIter -> IndexedSamples and fns IteratorRandom::choose_multiple -> sample, choose_multiple_fill -> sample_fill (#1632)
  • Use Edition 2024 and MSRV 1.85 (#1653)
  • Let Fill be implemented for element types, not sliceable types (#1652)
  • Fix OsError::raw_os_error on UEFI targets by returning Option<usize> (#1665)
  • Replace fn TryRngCore::read_adapter(..) -> RngReadAdapter with simpler struct RngReader (#1669)
  • Remove fns SeedableRng::from_os_rng, try_from_os_rng (#1674)
  • Remove Clone support for StdRng, ReseedingRng (#1677)
  • Use postcard instead of bincode to test the serde feature (#1693)
  • Avoid excessive allocation in IteratorRandom::sample when amount is much larger than iterator size (#1695)
  • Rename os_rng -> sys_rng, OsRng -> SysRng, OsError -> SysError (#1697)
  • Rename Rng -> RngExt as upstream rand_core has renamed RngCore -> Rng (#1717)

Additions

  • Add fns IndexedRandom::choose_iter, choose_weighted_iter (#1632)
  • Pub export Xoshiro128PlusPlus, Xoshiro256PlusPlus prngs (#1649)
  • Pub export ChaCha8Rng, ChaCha12Rng, ChaCha20Rng behind chacha feature (#1659)
  • Fn rand::make_rng() -> R where R: SeedableRng (#1734)

Removals

  • Removed ReseedingRng (#1722)
  • Removed unused feature "nightly" (#1732)
  • Removed feature small_rng (#1732)

... (truncated)

Commits

Updates thiserror from 1.0.69 to 2.0.19

Release notes

Sourced from thiserror's releases.

2.0.19

  • Update to syn 3

2.0.18

2.0.17

  • Use differently named __private module per patch release (#434)

2.0.16

  • Add to "no-std" crates.io category (#429)

2.0.15

  • Prevent Error::provide API becoming unavailable from a future new compiler lint (#427)

2.0.14

  • Allow build-script cleanup failure with NFSv3 output directory to be non-fatal (#426)

2.0.13

  • Documentation improvements

2.0.12

  • Prevent elidable_lifetime_names pedantic clippy lint in generated impl (#413)

2.0.11

2.0.10

  • Support errors containing a generic type parameter's associated type in a field (#408)

2.0.9

  • Work around missing_inline_in_public_items clippy restriction being triggered in macro-generated code (#404)

2.0.8

  • Improve support for macro-generated derive(Error) call sites (#399)

2.0.7

  • Work around conflict with #[deny(clippy::allow_attributes)] (#397, thanks @​zertosh)

2.0.6

  • Suppress deprecation warning on generated From impls (#396)

2.0.5

  • Prevent deprecation warning on generated impl for deprecated type (#394)

2.0.4

  • Eliminate needless_lifetimes clippy lint in generated From impls (#391, thanks @​matt-phylum)

2.0.3

  • Support the same Path field being repeated in both Debug and Display representation in error message (#383)

... (truncated)

Commits
  • e13a785 Release 2.0.19
  • 0a0e76c Update to syn 3
  • ec42ea7 Update actions/upload-artifact@v6 -> v7
  • 4178c4a Update actions/checkout@v6 -> v7
  • 7214e0e Ignore items_after_statements pedantic clippy lint in test
  • febcc03 Merge pull request #451 from vip892766gma/maint/20260521171412
  • c50e387 chore: improve thiserror maintenance path
  • d4a2507 Raise minimum tested compiler to rust 1.85
  • 99e8a6c Unpin CI miri toolchain
  • 9ac165c Pin CI miri to nightly-2026-02-11
  • Additional commits viewable in compare view

Updates jsonwebtoken from 10.4.0 to 11.0.0

Changelog

Sourced from jsonwebtoken's changelog.

11.0.0 (2026-07-24)

  • Add conversions between Algorithm and KeyAlgorithm
  • JWKs can now be created from DecodingKeys, creation from EncodingKey and DecodingKey now supports Ed25519 as well
  • JWKs with unknown key types are now deserializable
  • BREAKING: Algorithm, KeyAlgorithm, EllipticCurve and ThumbprintHash are now non_exhaustive
  • BREAKING: Jwk.thumbprint now returns a Result<_>
  • BREAKING: Header.extras is now a struct that allows for deserialization to any T
  • BREAKING: Implicit features resulting from optional crates have been removed
  • BREAKING: Validation.insecure_disable_signature_validation has been removed, use dangerous::insecure_decode instead
  • BREAKING: EncodingKey.inner has been renamed to as_bytes, try_get_hmac_secret has been removed
  • BREAKING: DecodingKey.as_bytes and try_get_hmac_secret have been removed, use try_get_as_bytes instead

Changes for CryptoProviders

  • When constructing HMAC signers, the algorithm family must now be verified on construction
  • JwkUtils has been renamed to KeyUtils
    • compute_digest now returns a Result<_>
    • extract_rsa_public_key_components has been renamed to rsa_pub_components_from_private_key
    • rsa_pub_components_from_public_key has been added
    • extract_ec_public_key_coordinates has been renamed to ec_pub_components_from_private_key
    • ed_pub_components_from_private_key has been added
Commits

Updates p256 from 0.13.2 to 0.14.0

Commits

Updates base64 from 0.22.1 to 0.23.0

Changelog

Sourced from base64's changelog.

0.23.0

  • Added more consts for preconfigured configs and engines
  • Make DecodeError::InvalidLastSymbol more clear by including the decoded value
  • Added SIMD-accelerated engines behind the default-on simd-unsafe feature: Simd picks the best instruction set at runtime (AVX2 on x86_64, NEON on aarch64) and falls back to the scalar GeneralPurpose engine, while Avx2 and Neon target one instruction set with no runtime detection and work in no_std. The engines support the standard and URL-safe alphabets.
  • Update MSRV to 1.71.0
  • Add support for custom padding symbols
Commits
  • 9e9220a v0.23.0
  • 870326e Merge pull request #306 from marshallpierce/mp/trailing-bits-docs
  • fbec5f1 Document no trailing trailing bits
  • 0a23549 Merge pull request #305 from marshallpierce/mp/edition-2021
  • f10b7e2 Update deps & edition
  • 9d21a59 Merge pull request #304 from marshallpierce/mp/custom-padding-rebase
  • f70bad2 Support custom padding symbols
  • 684d79c Merge pull request #301 from marshallpierce/mp/simd-gardening
  • 5bf66f2 Merge pull request #284 from AbeZbm/add-tests
  • d3831cf Followups to SIMD work
  • Additional commits viewable in compare view

Updates sha2 from 0.10.9 to 0.11.0

Commits

Updates thiserror from 1.0.69 to 2.0.19

Release notes

Sourced from thiserror's releases.

2.0.19

  • Update to syn 3

2.0.18

2.0.17

  • Use differently named __private module per patch release (#434)

2.0.16

  • Add to "no-std" crates.io category (#429)

2.0.15

  • Prevent Error::provide API becoming unavailable from a future new compiler lint (#427)

2.0.14

  • Allow build-script cleanup failure with NFSv3 output directory to be non-fatal (#426)

2.0.13

  • Documentation improvements

2.0.12

  • Prevent elidable_lifetime_names pedantic clippy lint in generated impl (#413)

2.0.11

2.0.10

  • Support errors containing a generic type parameter's associated type in a field (#408)

2.0.9

  • Work around missing_inline_in_public_items clippy restriction being triggered in macro-generated code (#404)

2.0.8

  • Improve support for macro-generated derive(Error) call sites (#399)

2.0.7

  • Work around conflict with #[deny(clippy::allow_attributes)] (#397, thanks @​zertosh)

2.0.6

  • Suppress deprecation warning on generated From impls (#396)

2.0.5

  • Prevent deprecation warning on generated impl for deprecated type (#394)

2.0.4

  • Eliminate needless_lifetimes clippy lint in generated From impls (#391, thanks @​matt-phylum)

2.0.3

  • Support the same Path field being repeated in both Debug and Display representation in error message (#383)

... (truncated)

Commits
  • e13a785 Release 2.0.19
  • 0a0e76c Update to syn 3
  • ec42ea7 Update actions/upload-artifact@v6 -> v7
  • 4178c4a Update actions/checkout@v6 -> v7
  • 7214e0e Ignore items_after_statements pedantic clippy lint in test
  • febcc03 Merge pull request #451 from vip892766gma/maint/20260521171412
  • c50e387 chore: improve thiserror maintenance path
  • d4a2507 Raise minimum tested compiler to rust 1.85
  • 99e8a6c Unpin CI miri toolchain
  • 9ac165c Pin CI miri to nightly-2026-02-11
  • Additional commits viewable in compare view

Updates jsonwebtoken from 10.4.0 to 11.0.0

Changelog

Sourced from jsonwebtoken's changelog.

11.0.0 (2026-07-24)

  • Add conversions between Algorithm and KeyAlgorithm
  • JWKs can now be created from DecodingKeys, creation from EncodingKey and DecodingKey now supports Ed25519 as well
  • JWKs with unknown key types are now deserializable
  • BREAKING: Algorithm, KeyAlgorithm, EllipticCurve and ThumbprintHash are now non_exhaustive
  • BREAKING: Jwk.thumbprint now returns a Result<_>
  • BREAKING: Header.extras is now a struct that allows for deserialization to any T
  • BREAKING: Implicit features resulting from optional crates have been removed
  • BREAKING: Validation.insecure_disable_signature_validation has been removed, use dangerous::insecure_decode instead
  • BREAKING: EncodingKey.inner has been renamed to as_bytes, try_get_hmac_secret has been removed
  • BREAKING: DecodingKey.as_bytes and try_get_hmac_secret have been removed, use try_get_as_bytes instead

Changes for CryptoProviders

  • When constructing HMAC signers, the algorithm family must now be verified on construction
  • JwkUtils has been renamed to KeyUtils
    • compute_digest now returns a Result<_>
    • extract_rsa_public_key_components has been renamed to rsa_pub_components_from_private_key
    • rsa_pub_components_from_public_key has been added
    • extract_ec_public_key_coordinates has been renamed to ec_pub_components_from_private_key
    • ed_pub_components_from_private_key has been added
Commits

Updates hmac from 0.12.1 to 0.13.0

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): Bump the cargo group across 2 directories with 8 updates
6712bf2 
Bumps the cargo group with 7 updates in the /sdk/linux directory:

| Package | From | To |
| --- | --- | --- |
| [base64](https://github.com/marshallpierce/rust-base64) | `0.22.1` | `0.23.0` |
| [sha2](https://github.com/RustCrypto/hashes) | `0.10.9` | `0.11.0` |
| [digest](https://github.com/RustCrypto/traits) | `0.10.7` | `0.11.3` |
| [rand](https://github.com/rust-random/rand) | `0.8.7` | `0.10.2` |
| [thiserror](https://github.com/dtolnay/thiserror) | `1.0.69` | `2.0.19` |
| [jsonwebtoken](https://github.com/Keats/jsonwebtoken) | `10.4.0` | `11.0.0` |
| [p256](https://github.com/RustCrypto/elliptic-curves) | `0.13.2` | `0.14.0` |

Bumps the cargo group with 5 updates in the /sdk/rust directory:

| Package | From | To |
| --- | --- | --- |
| [base64](https://github.com/marshallpierce/rust-base64) | `0.22.1` | `0.23.0` |
| [sha2](https://github.com/RustCrypto/hashes) | `0.10.9` | `0.11.0` |
| [thiserror](https://github.com/dtolnay/thiserror) | `1.0.69` | `2.0.19` |
| [jsonwebtoken](https://github.com/Keats/jsonwebtoken) | `10.4.0` | `11.0.0` |
| [hmac](https://github.com/RustCrypto/MACs) | `0.12.1` | `0.13.0` |



Updates `base64` from 0.22.1 to 0.23.0
- [Changelog](https://github.com/marshallpierce/rust-base64/blob/master/RELEASE-NOTES.md)
- [Commits](marshallpierce/rust-base64@v0.22.1...v0.23.0)

Updates `sha2` from 0.10.9 to 0.11.0
- [Commits](RustCrypto/hashes@sha2-v0.10.9...sha2-v0.11.0)

Updates `digest` from 0.10.7 to 0.11.3
- [Commits](RustCrypto/traits@digest-v0.10.7...digest-v0.11.3)

Updates `rand` from 0.8.7 to 0.10.2
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/master/CHANGELOG.md)
- [Commits](rust-random/rand@0.8.7...0.10.2)

Updates `thiserror` from 1.0.69 to 2.0.19
- [Release notes](https://github.com/dtolnay/thiserror/releases)
- [Commits](dtolnay/thiserror@1.0.69...2.0.19)

Updates `jsonwebtoken` from 10.4.0 to 11.0.0
- [Changelog](https://github.com/Keats/jsonwebtoken/blob/master/CHANGELOG.md)
- [Commits](Keats/jsonwebtoken@v10.4.0...v11.0.0)

Updates `p256` from 0.13.2 to 0.14.0
- [Commits](RustCrypto/elliptic-curves@p256/v0.13.2...p256/v0.14.0)

Updates `base64` from 0.22.1 to 0.23.0
- [Changelog](https://github.com/marshallpierce/rust-base64/blob/master/RELEASE-NOTES.md)
- [Commits](marshallpierce/rust-base64@v0.22.1...v0.23.0)

Updates `sha2` from 0.10.9 to 0.11.0
- [Commits](RustCrypto/hashes@sha2-v0.10.9...sha2-v0.11.0)

Updates `thiserror` from 1.0.69 to 2.0.19
- [Release notes](https://github.com/dtolnay/thiserror/releases)
- [Commits](dtolnay/thiserror@1.0.69...2.0.19)

Updates `jsonwebtoken` from 10.4.0 to 11.0.0
- [Changelog](https://github.com/Keats/jsonwebtoken/blob/master/CHANGELOG.md)
- [Commits](Keats/jsonwebtoken@v10.4.0...v11.0.0)

Updates `hmac` from 0.12.1 to 0.13.0
- [Commits](RustCrypto/MACs@hmac-v0.12.1...hmac-v0.13.0)

---
updated-dependencies:
- dependency-name: base64
  dependency-version: 0.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: sha2
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: digest
  dependency-version: 0.11.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: rand
  dependency-version: 0.10.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: thiserror
  dependency-version: 2.0.19
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: cargo
- dependency-name: jsonwebtoken
  dependency-version: 11.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: cargo
- dependency-name: p256
  dependency-version: 0.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: base64
  dependency-version: 0.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: sha2
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: thiserror
  dependency-version: 2.0.19
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: cargo
- dependency-name: jsonwebtoken
  dependency-version: 11.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: cargo
- dependency-name: hmac
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Aug 1, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, native-sdk. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot
dependabot Bot requested a review from StringKe as a code owner August 1, 2026 15:18
@StringKe StringKe mentioned this pull request Aug 11, 2026
Merged
@StringKe

StringKe commented Aug 11, 2026

Copy link
Copy Markdown
Owner

Superseded by #56 which batches dependency upgrades and related security fixes on current main.

@StringKe StringKe closed this Aug 11, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 11, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/cargo/sdk/linux/cargo-dcddfa4c30 branch August 11, 2026 11:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@StringKe StringKe Awaiting requested review from StringKe StringKe is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@StringKe